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IN THE CLAIMS 

Amended claims follow: 

1 . (Currently Amended) A computer program product carrying a computer program 
operable to control a computer to detect malware within a computer file, said computer 
program comprising: 

identifying code operable to identify said computer file as potentially being a 
specific known malware fi-ee computer file; 

determining code operable to determine one or more attributes of said computer 
file; and 

comparing code operable to compare said one or more attributes determined from 
said computer file with corresponding stored attributes of said specific known malware 
free computer file; 

wherein if said attributes match, then confirming said computer file as being said 
specific known malware free computer file; and 

i r said attributes do not match then performing fijrther malware detection 
processing upon said computer file; 

wherein said identifying code is operable to compare a file name, and a storage 
location of said computer file with a corresponding file name, and storage location of said 
specific known malware free computer file . 

2. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein said identifying code is further operable to compare one or more of file name, 
storage location and a file size of said computer file with a corresponding one or more of 
file name, storage location and file size of said specific known malware free computer 
file. 

3. (Original) A computer program product as claimed in claim 1, wherein said 
computer file is identified as being potentially one specific known malware free computer 
file from among a plurality of specific known malware free computer files. 
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4. (Original) A computer program product as claimed in claim 1 , wherein said one 
or more attributes include one of more of: 

a checksum calculated from at least a portion of said computer file; and 
content of at least a portion of said computer file. 

5. (Original) A computer program product as claimed in claim 1, wherein said 
further malware detection processing includes detecting within said computer file one or 
more characteristic corresponding to a known malware file. 

6. (Original) A computer program product as claimed in claim 5, wherein said one 
or more characteristic corresponding to a known malware file are stored within a 
malware signature file. 

7. (Original) A computer program product as claimed in claim 1 , wherein said 
specific known malware fi"ee computer file is one of: 

an operating system file; 
a help file; and 

a malware detection soflware file. 

8. (Original) A computer program product as claimed in claim 1 , wherein said 
malware being detected is one or more of: 

a computer virus; 

a computer worm; 

a computer Trojan; 

a banned computer file; and 

a computer file containing banned data. 

9. (Currently Amended) A method of detecting malware within a computer file, said 
method comprising the[[ steps of]]: 
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identifying said computer file as potentially being a specific known malware free 
computer file; 

determining one or more attributes of said computer file; and 

comparing said one or more attributes determined from said computer file with 
corresponding stored attributes of said specific known malware free computer file; 

wherein if said attributes match, then confirming said computer file as being said 
specific known malware free computer file; and 

if said atfributes do not match then performing fijrther malware detection 
processing upon said computer file; 

wherein said identifying is operable to compare a file name, and a storage location 
of said computer file with a corresponding file name, and storage location of said specific 
known malware free computer file . 

10. (Currently Amended) A method as claimed in claim 9, wherein said [[step of]] 
identifying fiirther compares one or more of file name, storage location and a file size of 
said computer file with a corresponding ono or more of file name, storage location and 
file size of said specific known malware free computer file. 

1 1 . (Original) A method as claimed in claim 9, wherein said computer file is 
identified as being potentially one specific known malware free computer file from 
among a plurality of specific known malware free computer files. 

12. (Original) A method as claimed in claim 9, wherein said one or more attributes 
include one of more of: 

a checksum calculated from at least a portion of said computer file; and 
content of at least a portion of said computer file. 

13. (Original) A method as claimed in claim 9, wherein said further malware 
detection processing includes detecting within said computer file one or more 
characteristic corresponding to a known malware file. 



-5- 



14. (Original) A method as claimed in claim 13, wherein said one or more 
characteristic corresponding to a known malware file are stored within a malware 
signature file. 

1 5 . (Original) A method as claimed in claim 9, wherein said specific known malware 
free computer file is one of: 

an operating system file; 
a help file; and 

a malware detection software file. 

16. (Original) A method as claimed in claim 9, wherein said malware being detected 
is one or more of: 

a computer virus; 

a computer worm; 

a computer Trojan; 

a banned computer file; and 

a computer file containing banned data. 

17. (Currently Amended) Apparatus for detecting malware within a computer file, 
said apparatus comprising: 

identifying logic operable to identify said computer file as potentially being a 
specific known malware free computer file; 

determining logic operable to determine one or more attributes of said computer 
file; and 

comparing logic operable to compare said one or more attributes determined from 
said computer file with corresponding stored attributes of said specific known malware 
fi-ee computer file; 

wherein if said attributes match, then confirming said computer file as being said 
specific known malware free computer file; and 

if said attributes do not match then performing fiirther malware detection 
processing upon said computer file; 
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wherein said identifying logic is operable to compare a file name, and a storage 
location of said computer file with a corresponding file name, and storage location of said 
specific known malware free computer file . 

18. (Currently Amended) Apparatus as claimed in claim 17, wherein said identifying 
logic is operable to further compare ono or more of file name, storage location and a file 
size of said computer file with a corresponding ono or more of file name, storage location 
aad-file size of said specific known malware free computer file. 

19. (Original) Apparatus as claimed in claim 17, wherein said computer file is 
identified as being potentially one specific known malware free computer file from 
among a plurality of specific known malware free computer files. 

20. (Original) Apparatus as claimed in claim 17, wherein said one or more attributes 
include one of more of: 

a checksum calculated from at least a portion of said computer file; and 
content of at least a portion of said computer file. 

21. (Original) Apparatus as claimed in claim 17, wherein said fijrther malware 
detection processing includes detecting within said computer file one or more 
characteristic corresponding to a known malware file. 

22. (Original) Apparatus as claimed in claim 21, wherein said one or more 
characteristic corresponding to a known malware file are stored within a malware 
signature file. 

23. (Original) Apparatus as claimed in claim 17, wherein said specific known 
malware free computer file is one of: 

an operating system file; 
a help file; and 

a malware detection software file. 
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24. (Original) Apparatus as claimed in claim 17, wherein said malware being detected 
is one or more of: 

a computer virus; 

a computer worm; 

a computer Trojan; 

a banned computer file; and 

a computer file containing banned data. 

25. (New) A computer program product as claimed in claim 1, wherein said storage 
location of said computer file is a known storage location or a relative storage location. 

26. (New) A computer program product as claimed in claim 25, wherein said relative 
storage location is determined by a configuration setting. 

27. (New) A computer program product as claimed in claim 1, wherein said 
corresponding file name, and storage location of said specific known malware free 
computer file are stored within a malware signature file. 

28. (New) A computer program product as claimed in claim 1 , wherein said stored 
attributes of said specific known malware free computer file are stored within a malware 
signature file. 

29. (New) A computer program product as claimed in claim 1 , wherein further 
malware detection processing is performed upon said computer file if said computer file 
is not identified as potentially being one specific known malware free computer file from 
among a plvirality of specific known malware free computer files. 

30. (New) A computer program product as claimed in claim 1, wherein said 
identifying code, said determining code, said comparing code, and said further malware 
detection processing are performed by a malware scanner. 



